Re: [PATCH] vsock/vmci: reject datagram binds in local network namespaces

[Stefano Garzarella <sgarzare@redhat.com>]

On Fri, Nov 13, 2026 at 06:04:40PM +0100, Sergio Lopez wrote:
>VMCI already rejects datagram sends from local network namespaces, but a
>datagram bind still creates a receive handle in VMCI's global port space.
>A VMCI sender outside the namespace can therefore deliver to the local
>socket. Its handle also prevents a global-namespace socket from binding
>the same port.
>
>Reject VMCI datagram binds in local namespaces. No namespace-local
>datagram transport exists, so EOPNOTSUPP reflects the available receive
>paths. The receive callback also rejects any local-mode socket as a
>defensive check.
>
>In a KASAN/lockdep QEMU guest, a reproducer observed cross-namespace
>delivery and the global port collision before the fix. After the fix,
>local bind returns EOPNOTSUPP, the global bind succeeds, and a global
>VMCI datagram still reaches the global socket.
>
>Fixes: eafb64f40ca4 ("vsock: add netns to vsock core")
>Cc: stable@vger.kernel.org
>Link: https://lore.kernel.org/all/sashiko-outbox-212907@kernel.org/
>Signed-off-by: Sergio Lopez <slp@redhat.com>
>---
> net/vmw_vsock/vmci_transport.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
>diff --git a/net/vmw_vsock/vmci_transport.c 
>b/net/vmw_vsock/vmci_transport.c
>index 1f186e8f8364..282131544c42 100644
>--- a/net/vmw_vsock/vmci_transport.c
>+++ b/net/vmw_vsock/vmci_transport.c
>@@ -627,6 +627,8 @@ static int vmci_transport_recv_dgram_cb(void *data, struct vmci_datagram *dg)
> 	 * outside of the create and destruct socket functions.
> 	 */
> 	vsk = vsock_sk(sk);
>+	if (!vsock_net_mode_global(vsk))
>+		return VMCI_ERROR_NO_ACCESS;
> 	if (!vmci_transport_allow_dgram(vsk, dg->src.context))

Why duplicating the VMCI_ERROR_NO_ACCESS return? Can we just put them in 
OR ?

The rest LGTM, if you respin, maybe we should mention that also 
connect() and sendmsg() are affected since they call vsock_auto_bind().

@Bryan, @Vishnu PTAL.

Thanks,
Stefano

> 		return VMCI_ERROR_NO_ACCESS;
>
>@@ -1697,6 +1699,10 @@ static int vmci_transport_dgram_bind(struct vsock_sock *vsk,
> 	u32 flags;
> 	int err;
>
>+	/* VMCI handles are global and cannot serve local namespaces. */
>+	if (!vsock_net_mode_global(vsk))
>+		return -EOPNOTSUPP;
>+
> 	/* VMCI will select a resource ID for us if we provide
> 	 * VMCI_INVALID_ID.
> 	 */
>
>---
>base-commit: 65ba8f34ec886ec72b2c07ddc8cf3d815c32869d
>change-id: 20261113-vsock-vmci-netns-isolation-7e46732dcd73
>
>Best regards,
>-- 
>Sergio Lopez <slp@redhat.com>
>